The vulnerability of computer systems, configurations, software, information codings and protocols to unauthorized access or use is problematic. In general, these vulnerabilities can range from minor annoyances to national security risks. Automated tools facilitate probing of systems and discovering vulnerable systems and configurations. Once vulnerabilities are identified, exploits (often embodied as computer viruses, worms, trojans, spyware, rootkits and/or other malicious forms of code) can be globally disseminated and rapidly employed.
In recognition of threats posed by such vulnerabilities, methods have been developed to identify malicious software in use, in media or in transit. Indeed, persons of skill in the art will appreciate a broad range of existing methods including signature- and/or behavior-based detection methods employed in commercially-available anti-virus and/or intrusion detection/prevention systems.
Unfortunately, once running, malicious software may attempt to hide itself, disable existing security checks or otherwise evade detection. In some cases, the very tools and facilities that might be relied upon to detect, isolate, terminate or mitigate malicious code are themselves subject to compromise. For example, if an operating system (or an antivirus/intrusion detection facility) is itself compromised, it may be unrealistic to expect the compromised system/facility to reliably interdict malicious code even if an exploit is successfully identified. Indeed, a common strategy of many exploits (after gaining privileged access) is to disable, interfere with, or otherwise subvert the very systems that are designed to protect against them.